Your website says 'Not Secure' — how to fix it
The 'Not Secure' warning means your site has no working SSL certificate. Customers notice it and it costs you enquiries. Here's what causes it and how to fix each cause.
Quick answer
'Not Secure' means your site isn't served over HTTPS, either because it has no SSL certificate or because the certificate expired. On a website builder or modern host, SSL is free and usually a single setting — turn it on, then force HTTPS so visitors always land on the secure version. If your certificate simply expired, renewing or reissuing it fixes it immediately.
Step-by-step
- 1
Work out which problem you have
Visit your site and type https:// in front of the address. If the secure version loads fine, you have a certificate but visitors aren't being sent to it — that's a redirect problem. If you get a certificate warning or the page won't load, the certificate is missing or expired. The two have different fixes.
- 2
Turn on SSL where your site is hosted
Every mainstream website builder and host offers free SSL, usually through Let's Encrypt, and it's typically a toggle in the domain or security settings. Enable it and allow a few minutes to a few hours for the certificate to issue. If you're on a builder, this is generally handled automatically and there's nothing to buy.
- 3
Force HTTPS so nobody sees the old version
Having a certificate isn't enough if visitors can still reach the insecure address. Look for a setting called 'force HTTPS', 'always use HTTPS', or 'SSL redirect' and turn it on. Without this, some visitors — and search engines — keep landing on the unsecured version.
- 4
Fix mixed content if the warning persists
If the padlock still doesn't appear, the page is probably loading an image, script, or font over plain HTTP. Most browsers' developer tools will name the offending file in the console. Change those references to https:// and the warning clears.
- 5
Set a reminder — or use something that auto-renews
Certificates expire, typically annually or more frequently. Most modern hosts and builders renew automatically; if yours doesn't, put a calendar reminder a month before expiry. An expired certificate produces a scarier warning than having none at all.
Tips & best practices
- ▸SSL is free — anyone charging you a meaningful annual fee for a basic certificate is selling something you can get for nothing.
- ▸The warning costs real enquiries; visitors read 'Not Secure' as 'this business is not legitimate', even on a site collecting nothing.
- ▸HTTPS is a ranking signal, so this affects search visibility as well as trust.
- ▸After fixing it, check the site on a phone as well as a desktop — caching can make one look fine while the other still warns.
Common questions
Why does my website say 'Not Secure'?
+−
Because it's being served over HTTP rather than HTTPS — either there's no SSL certificate installed, or the one you had has expired. Browsers now label every non-HTTPS page this way regardless of whether it collects any information.
How do I fix the 'Not Secure' warning?
+−
Enable SSL in your hosting or website builder settings — it's free and usually a single toggle — then turn on 'force HTTPS' so visitors always reach the secure version. If the padlock still doesn't show, something on the page is loading over HTTP and needs its address changed to https://.
Does 'Not Secure' matter if I don't take payments?
+−
Yes. Visitors don't distinguish between a shop and a brochure site — they see a browser warning and read it as a signal the business isn't trustworthy. It also affects search rankings, since HTTPS is a positive signal.
How much does an SSL certificate cost?
+−
Nothing for a standard certificate. Let's Encrypt provides them free and essentially every modern host and website builder issues and renews them automatically. Paid certificates exist for specialised validation needs that a small business almost never has.
I enabled SSL but it still says Not Secure. Why?
+−
Usually mixed content — the page itself is secure but it's pulling an image, font, or script over plain HTTP. Your browser's developer console will name the file. Occasionally it's simply caching, so try a hard refresh or a private window first.